en-US/about_EndpointForge.help.txt
|
TOPIC
about_EndpointForge SHORT DESCRIPTION Beginner-friendly Windows computer checkups, safe fix previews, comparisons, and reports. LONG DESCRIPTION A checklist is simply a list of things expected to be true, such as Windows settings, required files, recent events, or an available network service. Selecting, viewing, creating, or validating one does not run it or change Windows. EndpointForge helps a person answer four practical questions about a Windows computer: 1. Does this computer look healthy? 2. Do important settings and everyday checks match the selected checklist? 3. Which problems can EndpointForge safely preview and fix? 4. What changed between an earlier check and a later check? The guided menu uses everyday language and labels whether each choice reads information, creates a file, or can change a Windows setting. Normal checks do not change Windows. A supported fix is never applied until it has been selected, previewed, and explicitly approved. EndpointForge works in Windows PowerShell 5.1 and PowerShell 7 on supported Windows client and server versions. Its commands can also be used in approved scripts, scheduled tasks, Intune, Configuration Manager, RMM systems, and PowerShell remote sessions. FIRST RUN Install EndpointForge for the current Windows user: Install-Module -Name EndpointForge -Scope CurrentUser Import it and open the guided menu: Import-Module EndpointForge Show-EFMenu Start with menu option 1, Check this computer now. The check reads computer health, restart status, security information, and selected Windows settings. It does not change Windows. Some protected information and all approved fixes require a PowerShell window opened with Run as administrator. A standard-user window can still run normal checks and no-change previews. EVERYDAY TERMS EndpointForge uses plain wording in its menu. PowerShell commands retain several technical names so existing scripts remain compatible. Checklist A list of things expected to be true, such as settings, files, recent events, or an available network service. Selecting a checklist does not run or apply it. Baseline The script-facing name for a checklist. A parameter named Baseline asks which checklist to use. Checklist item One thing to check, such as a setting, file, event, or network connection. Control The script-facing name for a checklist item. ControlId is the item's stable name for scripts, such as EF-FW-DOMAIN. Matches EndpointForge read the current value and it equals the checklist value. Compliance The technical name for comparing current settings with a checklist. Compliant means a setting matches. NonCompliant means it was read successfully but does not match. Compliance checking by itself never changes Windows. Supported fix A narrow setting change EndpointForge knows how to preview, apply, and check again. Many findings are intentionally report-only. Remediation The script-facing name for applying a supported fix. A remediation plan only explains possible actions; it does not change Windows. Preview or WhatIf A no-change rehearsal. PowerShell calls this WhatIf and uses the -WhatIf switch. A preview shows what a supported fix would try to change without making the change. Could not check Windows did not provide a definite answer. This is not treated as passing, matching, or fixed. Administrator or elevated session A PowerShell window opened with Run as administrator. Windows requires this extra permission for protected information and setting changes. Endpoint An IT term for a managed computer. Receipt A record of an attempted fix, including the value before, the value afterward, the result, safety notes, and recovery guidance. HTML report A self-contained web-page file intended for a person to read in a browser. JSON report A structured data file intended for scripts and support tools. It preserves more nested technical detail than a human-readable report. GOAL-BASED MENU Show-EFMenu organizes work by the result a person wants: 1. Check this computer now Reads information and does not change Windows. 2. Understand the latest results Shows a simple summary, detailed explanations, earlier-versus-later changes, and computer details. 3. Fix selected problems safely Builds a plan, lets the user select supported fixes, performs a mandatory preview, and asks for final approval before any setting change. 4. Save reports or compare checks Creates a readable HTML report, a detailed JSON report, or a comparison when the user chooses that action. 5. Check other computers Runs non-changing checks on computers already prepared for approved PowerShell remote management. It never runs remote fixes. TCP checklist items require explicit approval and can make observable connections from every computer. 6. Change what EndpointForge checks Selects, loads, validates, or creates checklist files. Selecting a checklist never applies its settings. A. Tools for IT scripts and troubleshooting H. Help that explains every choice Q. Exit The menu keeps results only for the current menu session unless a report is saved. Changing the checklist clears earlier menu results so results from different checklists are not mistaken for one another. READINESS Readiness is a no-change preflight. It explains what the current PowerShell window is prepared to check or fix: Get-EFEndpointReadiness It checks whether the platform is Windows, whether the checklist is valid, whether the current window has Administrator permission, whether it is a remote session, and whether Windows provides the commands required by each checklist item. It does not read the actual policy values and does not change anything. A readiness result with limits does not mean the whole check failed. It means some protected or unavailable items may be reported as Could not check or report-only. Review the result details before deciding whether to reopen PowerShell with Run as administrator. RUN A COMPUTER CHECK The recommended read-only script command is: $check = Get-EFEndpointSummary -NoProgress $check | Show-EFEndpointSummary Show every finding and its explanation: $check | Show-EFEndpointSummary -Detailed Get-EFEndpointSummary returns structured data for scripts. Show-EFEndpointSummary is the display for people. Scripts should read object properties instead of parsing the displayed text. Include installed software only when it is needed because collection takes longer and the resulting report contains more private device information: $check = Get-EFEndpointSummary -IncludeSoftware -NoProgress UNDERSTAND RESULTS The terminal translates script statuses into these descriptions: Looks good The health and checklist items that were read do not need attention. Needs attention A warning or checklist difference was found. Urgent attention A critical health or security difference was found. Could not check everything One or more answers were unavailable, protected, or failed to load. Not used on this computer The feature is absent or does not apply to this Windows computer. Unknown information is never silently counted as healthy. Review WhyItMatters, HowChecked, WhatWouldChange, ManualAction, SafetyNotes, and RecoveryGuidance when those explanation fields are present. SAFE FIX FLOW Menu option 3 is the safest interactive path. It always follows this order: 1. Run or reuse a read-only computer check. 2. Explain each item that needs attention. 3. Separate supported fixes from manual review and unavailable information. 4. Let the user select specific supported fixes. 5. Run a fresh WhatIf preview that cannot change Windows. 6. Stop if the preview is incomplete or reports a failure. 7. Require a PowerShell window opened with Run as administrator. 8. Show the computer, selected items, current values, expected values, and possible restart impact. 9. Require the user to type APPLY exactly. 10. Apply only the selected items and check their new values. 11. Run a fresh computer check and show a before-and-after comparison. A standard-user window may complete the preview. It then explains how to reopen PowerShell as Administrator. EndpointForge does not restart itself with higher permission and does not bypass Windows security prompts. The equivalent script workflow is: $plan = Get-EFRemediationPlan -NoProgress $approvedIds = $plan.Steps | Where-Object CanFixAutomatically | Select-Object -ExpandProperty ControlId Invoke-EFEndpointRemediation -ControlId $approvedIds -WhatIf -NoProgress # Run only after approval, from an Administrator window. $result = Invoke-EFEndpointRemediation ` -ControlId $approvedIds -Confirm:$false -NoProgress $verification = Get-EFComplianceReport -ControlId $approvedIds -NoProgress The low-level apply command uses normal PowerShell confirmation behavior. Scripts are responsible for approval, selection, testing, and organizational change control. The menu adds the extra exact APPLY acknowledgement. The built-in EnterpriseRecommended checklist can offer narrow supported fixes for Windows Firewall profiles, User Account Control, Microsoft Defender real-time protection when Defender manages it, the SMB 1.0 optional feature, and the Windows Update service start setting. BitLocker, Secure Boot, and Trusted Platform Module readiness are report-only. EndpointForge will not change them automatically. RECEIPTS, RESTARTS, AND RECOVERY Each preview or applied fix returns a receipt. It records the before value, desired value, after value, whether a change was applied, what changed, and available safety and recovery guidance. EndpointForge never restarts Windows automatically. A receipt may say that an approved restart should be scheduled through the organization's normal process. EndpointForge does not promise automatic rollback. Restoring a saved value is not always safe because Group Policy, mobile-device management, Defender tamper protection, a service dependency, another security product, or a later Windows change may own the setting. Use the receipt's before value and RecoveryGuidance with an approved recovery process. Identify and use the owning management system when a centrally managed setting does not stay changed. SAVE REPORTS Save a human-readable HTML report: Get-EFEndpointSummary -NoProgress | Export-EFEndpointReport -Path .\computer-check.html The HTML file is self-contained. It uses embedded styling, loads no JavaScript, fonts, or internet content, and encodes report values before placing them in the page. Save detailed JSON data for scripts or support tools: Get-EFEndpointSummary -NoProgress | Export-EFEndpointReport -Path .\computer-check.json CSV and CLIXML are also supported. The file extension selects the format. Existing files require -Force. Export supports -WhatIf so a script can preview the file action. Reports may contain computer names, hardware, network addresses, installed software, security posture, checklist details, and change evidence. Store reports only in an approved location with least-privilege permissions and appropriate retention. COMPARE EARLIER AND LATER CHECKS Compare two saved JSON reports: $difference = Compare-EFEndpointSummary ` -Before .\before.json -After .\after.json $difference Or compare two in-memory results: $before = Get-EFEndpointSummary -NoProgress # Approved maintenance happens here. $after = Get-EFEndpointSummary -NoProgress Compare-EFEndpointSummary -Before $before -After $after The comparison separates definite improvements, newly detected problems, unchanged items, newly available information, and items the later check could not read. A missing or incomplete later result is never described as fixed. By default, checks with different computer names are rejected. Use -AllowDifferentComputer only for an intentional side-by-side view, not to measure progress. A warning is also returned when the checklist name or version changed, because that is not a like-for-like comparison. CHECK OTHER COMPUTERS WITHOUT CHANGING THEM Get-EFFleetSummary checks several Windows computers and returns successful results and connection failures in one object: $fleet = Get-EFFleetSummary -ComputerName PC-101,PC-102 $fleet.Results $fleet.Failures This command never changes Windows settings or runs fixes. A checklist containing TCP items can still make the observable connection attempts explained below. Before it can work, every target computer must already: - allow PowerShell remoting under the organization's policy; - have EndpointForge 0.5.0 or later installed; and - allow the connecting account to run the check. EndpointForge does not install itself remotely, enable WinRM, change TrustedHosts, adjust firewall rules, or run remote fixes. It reports connection failures alongside successful results. A checklist with TcpPort items is read-only, but every remote computer briefly tries the named connection. The destination, firewall, or network monitoring tools may record each attempt. Get-EFFleetSummary blocks these items until the checklist has been reviewed and -AllowNetworkChecks is supplied: Get-EFFleetSummary ` -ComputerName PC-101,PC-102 ` -Baseline .\checklists\Contoso.EverydayChecks.json ` -AllowNetworkChecks No application data is sent. A successful connection does not test HTTPS, sign-in, or whether the application itself is healthy. Use a credential only when the approved environment requires one: $credential = Get-Credential Get-EFFleetSummary ` -ComputerName (Get-Content .\computers.txt) ` -Credential $credential The credential is used for the remote connection and is not stored in the returned fleet report. Check an affected computer directly before approving any fix. CHECKLISTS FOR AN ORGANIZATION Load the built-in checklist: $checklist = Get-EFBaseline -Name EnterpriseRecommended Create an editable starter file and validate it: New-EFBaseline ` -Name Contoso.Workstation ` -Template Starter ` -Path .\checklists\Contoso.Workstation.json Test-EFBaseline ` -Path .\checklists\Contoso.Workstation.json ` -PassThru Create editable examples for a required file, text near the end of a log, recent Windows events, and one TCP connection: New-EFBaseline ` -Name Contoso.EverydayChecks ` -Template EverydayChecks ` -Path .\checklists\Contoso.EverydayChecks.json Replace every sample file path, search text, event source and ID, and host name before running the new checklist. The installed examples\EverydayChecks.json file explains each property in plain language. Use the validated file for a read-only check: Get-EFEndpointSummary ` -Baseline .\checklists\Contoso.Workstation.json ` -NoProgress New-EFBaseline creates a starting file. It is not a substitute for organizational review and testing. Template accepts Starter, EnterpriseRecommended, AuditOnly, or EverydayChecks. The command supports -WhatIf and will not replace an existing file unless -Force is used. Custom checklist files are privileged configuration input. Review them, store them in source control, and protect them from untrusted writes before an Administrator process uses them. Validate after every edit and before every deployment. EndpointForge 0.5.0 supports Registry, Service, FirewallProfile, Defender, WindowsOptionalFeature, BitLocker, SecureBoot, Tpm, FileExists, FileContainsText, WindowsEvent, and TcpPort checklist items. BitLocker, SecureBoot, Tpm, FileExists, FileContainsText, WindowsEvent, and TcpPort items are report-only. They report an answer and manual guidance, but EndpointForge never fixes them automatically. The four everyday types use a Boolean DesiredValue. True means the named file or text should be present, enough events should exist, or the connection should succeed. False means it should not. Set Remediable to false and RequiresReboot to false. FileExists Path is required. It checks one exact file on a local Windows drive. Environment variables such as %ProgramData% are allowed. Relative paths, network shares, mapped network drives, wildcards, alternate data streams, and paths through links are rejected. A folder does not count as a file. FileContainsText Path and Text are required, and the same safe local-path rules as FileExists apply. Text is an ordinary literal string, not a wildcard or regular expression. TailLines defaults to 2,000 and accepts 1 through 10,000. CaseSensitive defaults to false. Encoding defaults to Utf8 and also accepts Unicode, BigEndianUnicode, or Ascii. Only the selected tail is read. EndpointForge stops with Could not check if the file changes while being read or if the selected tail exceeds 8,388,608 decoded characters. The result says only whether the text was found; matching lines and other file contents are not included. WindowsEvent LogName and EventIds are required. EventIds can be one whole number from 0 through 65,535 or a list of up to 64 unique IDs. ProviderName can narrow the event source. LookbackMinutes defaults to 60 and accepts up to 10,080, which is seven days. MinimumCount defaults to 1 and accepts up to 1,000. Use event IDs documented for the selected log and source. Protected logs can require Run as administrator. Results contain a Boolean answer and bounded count summary, but no event messages or event data. TcpPort HostName and Port are required. TimeoutMilliseconds defaults to 3,000 and accepts 100 through 10,000. The host must be one exact DNS name or IP address, not a URL, path, or wildcard. EndpointForge makes one TCP connection attempt, closes it, and sends no application data. The destination and network monitoring tools may still record the attempt. Success proves only that TCP connected, not that HTTPS, authentication, or the application is healthy. A checklist can contain no more than 32 TcpPort items. Checklist files contain paths, search text, event sources, and network destinations. Results and reports can show which paths and destinations were checked and whether they matched, even though matching log lines and event contents are omitted. Protect all of these files according to the organization's data rules. A missing file is a definite false answer for FileExists. A missing or unreadable text file is Could not check because no trustworthy text answer is available. An unavailable or protected event log is also Could not check. For TcpPort, a refused or timed-out connection is false; a host name that cannot be resolved is Could not check. Missing evidence is never silently treated as success. COMMANDS FOR SCRIPTS Commands whose names begin with Get or Test return PowerShell objects and do not change Windows. Show commands display information for a person. New and Export commands write files only when requested. Invoke-EFEndpointRemediation is the command that can change supported Windows settings; -WhatIf turns it into a no-change preview. Useful discovery commands are: Get-Command -Module EndpointForge Get-Help Show-EFMenu -Full Get-Help Get-EFEndpointSummary -Full Get-Help Invoke-EFEndpointRemediation -Full Test-EFEndpointCompliance returns $true only when every applicable selected item matches and no checking error occurred. Add -PassThru, or use Get-EFComplianceReport, when a script needs details, scores, or an ExitCode. SCRIPT EXIT CODES EndpointForge commands do not exit the hosting PowerShell process. They return an ExitCode property. A wrapper script should call exit only when its management system requires a process exit code. Combined computer check and fleet check: 0 Checked items look good. 1 A warning or partial information needs attention. 2 A critical issue or checklist difference was found. 3 Required information could not be collected, or a fleet target failed. Detailed compliance report: 0 All applicable checked items match. 2 One or more checked items do not match. 3 One or more checked items could not be evaluated. Remediation report: 0 Approved fixes were verified, or no change was needed. 2 One or more selected items still do not match. A WhatIf preview normally leaves an item unchanged, so review PreviewCount as well as ExitCode. 3 Checking, applying, or verifying one or more selected items failed. Operational health report: 0 Healthy. 1 Warning. 2 Critical. SECURITY BOUNDARIES EndpointForge intentionally does not: - restart Windows; - install updates or other software; - turn on BitLocker or start drive encryption; - change Secure Boot, firmware, or Trusted Platform Module settings; - clear a Trusted Platform Module; - install itself on another computer or enable PowerShell remoting; - query Win32_Product for installed software; - download and execute remote content; - include matching log lines or Windows event contents in checklist results; - bypass Group Policy, mobile-device management, Defender tamper protection, application-control policy, or another security product; - apply an automatic menu change without selection, preview, Administrator permission, and exact APPLY acknowledgement; or - promise automatic rollback. Installed software is read from Windows uninstall registry records. Unsupported or unavailable Windows features are reported instead of silently omitted. Follow organizational execution-policy and application-control requirements. Do not bypass a centrally managed policy. Reinstalling this module does not override Group Policy. TROUBLESHOOTING If a result says Could not check, Access denied, Requires elevation, or that a protected security value was not returned: 1. Run Get-EFEndpointReadiness. 2. Open PowerShell with Run as administrator when approved. 3. Run the detailed check again: Get-EFEndpointSummary -NoProgress | Show-EFEndpointSummary -Detailed 4. If the result remains unavailable, confirm that the Windows edition, server role, virtual machine, firmware mode, and hardware support the feature. If a fix reports PartiallyChanged, EndpointForge observed a changed after-value before a later step reported an error. Review the before and after values plus recovery guidance immediately; do not assume the earlier value is still active. If a fix reports VerificationFailed or does not stay changed, Group Policy, Intune, another management product, Defender tamper protection, or a security agent may own the setting. Review the receipt and use the owning system for the lasting change. If a remote computer cannot be reached, confirm its name, network path, remoting policy, connecting-account permission, and installed EndpointForge version. The fleet command will not change those prerequisites. If the module installs but does not import, inspect the discovered version and effective execution policy: Get-Module -ListAvailable EndpointForge | Select-Object Name,Version,ModuleBase Get-ExecutionPolicy -List Import-Module EndpointForge -Verbose LOGGING File logging is disabled by default. Set-EFConfiguration can enable newline-delimited JSON logging for the current PowerShell process: Set-EFConfiguration ` -LogPath '%ProgramData%\EndpointForge\endpointforge.jsonl' ` -LogLevel Information Protect log locations with least-privilege permissions. Logs and reports are separate; reports are written only when Export-EFEndpointReport or a menu save action is used. SEE ALSO Show-EFMenu Get-EFEndpointReadiness Get-EFEndpointSummary Show-EFEndpointSummary Compare-EFEndpointSummary Get-EFFleetSummary Get-EFEndpointInventory Get-EFEndpointHealth Get-EFInstalledSoftware Get-EFPendingReboot Get-EFBaseline New-EFBaseline Test-EFBaseline Test-EFEndpointCompliance Get-EFComplianceReport Get-EFRemediationPlan Invoke-EFEndpointRemediation Export-EFEndpointReport Get-EFConfiguration Set-EFConfiguration |